Wire it up. Let it rip — safely.
Multi-agent pipelines you can trust to run unattended.
Define workflows in a small text file and run them locally with the guardrails already built in: a hard budget cap, a tamper-evident audit trail in git, and one command to explain any run. No observability stack to wire up, no surprise bill.
- Halt at $5, not $500. Hard caps on cost, tokens, and wall-time (
--max-cost 500 --max-tokens 100000 --max-wall-time 30m). The engine checks between every step and stops with a snapshot on breach. - Know exactly what happened. Every decision, token, and tool call lands in a git-committed, tamper-evident
activity.jsonl.tracker diagnosereads it back and tells you which node burned the budget or broke. - Bound what an agent can touch. (Linux) Declare
writable_pathsand a Landlock sandbox confines every write — the agent and its subprocesses — to the paths you name.
Install + run in 60 seconds
# 1. Install — pick one
brew install 2389-research/tap/tracker
# or
go install github.com/2389-research/tracker/cmd/tracker@latest
# 2. Run a built-in workflow (no file needed)
tracker build_productMore commands
# Verify your providers + tools
tracker doctor
# Run with the Claude Code agent backend
tracker --backend claude-code build_product
# Run autonomously — LLM judges every gate
tracker --autopilot mid build_product
# Headless — POST gates to your service
tracker --webhook-url https://factory.example.com/gate build_product
# Override workflow params + cap budget
tracker --param model=claude-opus-5 \
--max-cost 500 --max-wall-time 30m build_product
# Drive from any language: tracker --json | jq + parse activity.jsonl
tracker --json build_productFour flagship workflows are embedded in the binary — no cloning, no examples directory.
Or write your own in a .dip file (see below).
How is this different?
Tracker is not a replacement for Temporal or Airflow — those are excellent general workflow schedulers but they don’t model what LLM pipelines actually need (tokens, dollars, parallel branches with filesystem isolation, gates that resume from a webhook). And it’s not a Python library like LangGraph or LangChain — you don’t wire your own observability or eat your own surprise bills.
It’s the local-first, pipelines-as-text-in-git tool you reach for when “just run it” means “run it inside a budget, with a live TUI, and let me diff what happened later.”
What a pipeline looks like
Pipelines are .dip files, written in Dippin, our pipeline DSL. Yes, it’s small — the whole grammar
fits on one page; the snippet below is most of what you need.
agent Draft
model: claude-sonnet-5
prompt: "Draft a brief on ${params.topic}."
human Review
mode: yes_no
edges
Draft -> Review
Review -> Done when ctx.outcome = successDriving from Python or another language? Run the binary
with tracker --json and parse activity.jsonl.
A Go library API is available for in-process embedding.
What you get
Four guardrails ship in the box — the ones you’d otherwise wire up yourself — then the pipeline capabilities on top. Each note below is an honest limit, not fine print.
Kill a runaway agent at $5, not $500.
Hard caps on tokens, cost (cents), and wall-time as CLI flags or workflow defaults. The engine checks between every node and halts with a CostSnapshot on breach.
--max-cost 500 --max-tokens 100000 --max-wall-time 30m
Enforced between nodes, not to the cent — a single step can overshoot by its own cost. All platforms.
A git-committed record of every decision the run made.
Each edge selection, condition, token count, and node outcome lands in an append-only activity.jsonl written to an integrity-protected path and committed to git. Casual tampering — a tool subprocess forging a decision edge or faking status=success — is flagged.
Tamper-evident, not tamper-proof: it flags injection, not a same-UID forger, and is never cryptographically verified. All platforms.
tracker diagnose tells you which node burned the budget.
Post-run triage reads status.json + activity.jsonl and surfaces tool output, stderr, errors, timing anomalies, deterministic-vs-flaky retries, stalled loops, and escalation patterns. Available as a Go library call too.
A reader of the recorded log — it explains what happened, it doesn’t guarantee correctness. All platforms.
Linux Bound what an agent can write.
Declare writable_paths on a node and a Landlock (ABI v3) sandbox confines every write — the agent’s own tools and its whole Bash subprocess tree — to the globs you name. It fails closed: where Landlock is unavailable, a workflow that declares it refuses to start rather than run unprotected.
Linux only; native backend; bounds writes only — not network egress or reads.
Race three model variants in parallel; pick the winner.
Fan out to concurrent branches in isolated git worktrees, fan in to a join. Built-in pattern for cross-model races without filesystem stomping.
tracker ask_and_execute
See every token, tool call, and gate in a live TUI.
Bubble-tea dashboard, append-only activity log, per-node streams, search, drilldown. Every event also lands in activity.jsonl for grep + post-hoc analysis.
Pause for human approval; resume from a webhook.
Choice, freeform, hybrid, yes/no, and interview gates. Or POST the gate to your service and block on the callback. Per-gate timeout and outbound auth.
Steps pass typed JSON to each other — no glue code.
Declare what an agent produces with writes: [field, field]; downstream steps read those fields as typed values. The runtime validates the output, and a self-healing cascade rescues the common “LLM returned prose around the JSON” case.
Reconstruct any finished run from a single manifest.
Run capture writes the executed spec, the verbatim provider request bodies, and per-call/turn/session identity onto every audit line, then rolls them into a run.json. tracker run-json backfills one for archived or killed runs. Capture files land 0600 and never travel in exported bundles.
tracker run-json <runID>
Collect the inputs a workflow needs — before it runs.
A workflow declares a typed inputs signature; your front-end introspects it (DescribeInputs), validates a request with structured per-input errors (ValidateInputs), and binds it at run start. A missing required input fails closed before any node runs, instead of the agent inventing work. File and secret inputs stage to a 0600 file — a secret’s value never enters a prompt, the wire, the trace, or the checkpoint.
Benchmarks
A SWE-bench Verified run is in progress. The scored number will land here once the first run is green — we don’t publish a number before it’s real.
Stream pipeline status to your own users.
Every event — node started, gate hit, cost updated, run completed — lands in
activity.jsonl on disk and on stdout via tracker --json. Pipe it to your
customer dashboard, Slack bot, or status page. Webhook gates POST to your URL on every
human-decision point so approvals can render in your own app, not just the TUI.
tracker --json build_product | # pipe into your event bus / SSE relay / dashboardFour providers, one pipeline
Mix models freely. Route everything through a Cloudflare AI Gateway with --gateway-url for central analytics, caching, and 429 relief.
Anthropic
claude-opus-5 · claude-sonnet-5 · claude-fable-5 · claude-haiku-4-5
OpenAI
gpt-5.4 · gpt-5.4-mini · gpt-4.1 · o3 · o4-mini
Gemini
gemini-3.1-pro-preview · gemini-2.5-pro · gemini-2.5-flash
OpenAI-Compat
Any OpenAI-compatible endpoint
OpenRouter, vLLM, local proxies
Ready to build?
Install, run a built-in workflow, watch the TUI. If it survives tracker diagnose,
write your own pipeline next.